Sign inSign up

scanproject/vulnerable

By scanproject

•Updated over 2 years ago
Archived

Vulnerable NodeJS+Express App image

Image
0

785

scanproject/vulnerable repository overview

ARCHIVED PROJECT: We are currently focusing on a contract with a private company. We will update this page when we release the new generation of our products.

GitHub: https://github.com/samoylenko/vulnerable-app-nodejs-express⁠

⁠A sample application with known vulnerabilities - JavaScript, Express

A sample application with known issues for testing various linters, scanners, and scan automation.

This project uses:

ComponentIn Use
PlatformNodeJS⁠
Language(s)JavaScript (ECMAScript⁠)
Buildnpm⁠
FrameworkExpress⁠

⁠Security issues

Vulnerability TypeDescriptionLocationPoC Command
Cross Site Scripting (XSS)The /hello endpoint generates page output in code. It expects a name as a parameter to say "Hello, $name" and concatenates the user input to the output without escaping it.res.send(`Hello, ${req.query.name}`)http://localhost:8080/hello?name=%3Cscript%3Ealert(1)%3C/script%3E⁠
Cross Site Scripting (XSS)The /view endpoint uses a template engine to say "Hello, $name" and misuses template syntax, leaving the user input unescaped.p!= 'Hello, ' + namehttp://localhost:8080/view?name=%3Cscript%3Ealert(1)%3C/script%3E⁠
Cross Site Scripting (XSS)The /user endpoint reflects a value from the database directly to the page. Today, it's an ID, but in non statically typed languages this is still always a scenario.res.send(user.rows[0]);This one currently doesn't have a PoC exploit, since it reflects a number from the database to the page. But this is a legit injection scenario that has to be handled. We use it SAST issue prioritization testing
Hardcoded credentialsThere are secrets in the code committed to the repositoryPOSTGRES_PASSWORD=mysecretpassword

password: "mysecretpassword",		N/A
SQL Injection (SQLi)The SQL query is constructed using string concatenation instead of using a parameterized queryclient.query(`select * from users where id = ${req.params.id}`)http://localhost:8080/user/1;drop%20table%20users⁠

sqlmap -u localhost:8080/user/1 --all
Use of a vulnerable (outdated) libraryThis project includeslodash library version with known vulnerabilities"lodash": "4.17.20"CVE-2021-23337⁠, CVE-2020-28500⁠
⁠Other issues
  • There is at least one unused variable
  • The project has no tests
  • The project dependencies are not locked
  • A few var instead of const (ESlint rule: no-var⁠)
  • Library lodash is declared but never used
  • Style is inconsistent. E.g. a Standard Style⁠ linter would complain.
  • Plus container issues if you run docker build .

⁠Running this code

NOTE: This project contains security vulnerabilities and should be only run in testing purposes.

Requirements:

To run the code locally:

# Clone the project
git clone https://github.com/the-scan-project/tsp-vulnerable-app-nodejs-express.git
cd tsp-vulnerable-app-nodejs-express

# Install dependencies
npm i

# Start the database container
docker run --name some-postgres -e POSTGRES_PASSWORD=mysecretpassword -p 5432:5432 -d postgres

# Start the application
npm run start

Tag summary

Content type

Image

Digest

sha256:8d19257bc…

Size

338.7 MB

Last updated

over 2 years ago

docker pull scanproject/vulnerable